fleet/docs/01-Using-Fleet
Brock Walters b3acc96c4f
Update standard-query-library.yml (#16271)
It is very easy for data collection like this to veer into double /
triple negative mulitverse of madness stuff...

That said, I may have a lack of understanding about how the product
works, i.e., that a query literally must return a 0 value & not null in
order to "pass" in a policy. If so, then this works as expected.

However, if a query just needs to return empty (null) & 0 is implied in
the logic that sets a policy flag to green or red, then, as a rule,
queries like this should be always be simplified & should default to
using "positive" as opposed to "negative" logic, i.e., check if
something exists, never check if a thing does NOT exist.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

- [x] Added/updated tests: Tested by adding dummy Emergency Kit.pdf
files to Desktop & Downloads, running query, then, removing files &
running query.
2024-02-06 16:27:21 -05:00
..
standard-query-library Update standard-query-library.yml (#16271) 2024-02-06 16:27:21 -05:00